Evaluating cyber-risk in synchrophasor systems
Technology related to evaluating cyber-risk for synchrophasor systems is disclosed. In one example of the disclosed technology, a method includes generating an event tree model of a timing-attack on a synchrophasor system architecture. The event tree model can be based on locations and types of timing-attacks, an attack likelihood, vulnerabilities and detectability along a scenario path, and consequences of the timing-attack. A cyber-risk score of the synchrophasor system architecture can be determined using the event tree model. The synchrophasor system architecture can be adapted in response to the cyber-risk score.
1. A synchrophasor system comprising:
a synchrophasor measurement device; and
a processor in communication with the synchrophasor measurement device, the processor being configured to:
receive measurement data from the synchrophasor measurement device,
produce an event tree model of a timing attack on the synchrophasor system, the event tree model describing a chronological series of events subsequent to a triggering event,
assign a sub-branch of the event tree model a nonbinary value indicating a likelihood of a component in the synchrophasor system detecting an abnormality in the measurement data,
determine a cyber-risk score of the synchrophasor system using the event tree model and the received measurement data, and
change an operating parameter of a component of the synchrophasor system based on the cyber-risk score.
2. The system of claim 1 , wherein the measurement data comprises a synchronized timestamp.
3. The system of claim 2 , wherein determining the cyber-risk score of the synchrophasor system comprises determining whether the synchronized timestamp of the measurement data is missing.
4. The system of claim 2 , wherein determining the cyber-risk score of the synchrophasor system comprises determining whether the synchronized timestamp of the measurement data is modified.
5. The system of claim 1 , wherein the synchrophasor measurement device comprises a phasor measurement unit.
6. The system of claim 1 , wherein determining the cyber-risk score of the synchrophasor system comprises determining a vulnerability score for a respective component of the synchrophasor system.
7. The system of claim 6 , wherein the vulnerability score for the respective component of the synchrophasor system is based on physical accessibility of the respective component, an attack complexity for exploiting the respective component, and a privilege level for accessing the respective component.
8. The system of claim 1 , wherein changing the operating parameter of the component of the synchrophasor system comprises removing the component from the synchrophasor system.
9. The synchrophasor system of claim 1 , wherein a sub-branch of the event tree model is assigned a probability based on a likelihood of occurrence of the event and/or a likelihood of a component in the synchrophasor system detecting an abnormality in the measurement data.
10. The synchrophasor system of claim 1 , wherein the event tree model further indicates one or more consequences that result from the chronological series of events.
11. A method comprising:
generating an event tree model of a timing attack on a synchrophasor system architecture, the event tree model describing a chronological series of events subsequent to a triggering event;
assigning a sub-branch of the event tree model a nonbinary value indicating a likelihood of a component in the synchrophasor system architecture detecting an abnormality;
determining a cyber-risk score of the synchrophasor system architecture using the event tree model, wherein the cyber-risk score is an overall cyber-risk score determined from individual cyber-risk scores determined for respective elements in the synchrophasor system architecture; and
adapting the synchrophasor system architecture in response to the cyber-risk score.
12. The method of claim 11 , wherein generating the event tree model comprises generating a branch-point of the event tree model for a respective component of the synchrophasor system and sub-branches from the branch-point for different respective consequences of a timing attack at the respective component.
13. The method of claim 12 , wherein one of the respective consequences of the timing attack is a modified timestamp being generated at the respective component.
14. The method of claim 11 , wherein determining the cyber-risk score of the synchrophasor system architecture using the event tree model comprises determining a vulnerability score for a respective component of the synchrophasor system and identifying the respective component as being vulnerable because its vulnerability score exceeds a threshold value.
15. The method of claim 14 , wherein the vulnerability score for the respective component of the synchrophasor system is based on a physical accessibility of the respective component.
16. The method of claim 11 , wherein adapting the synchrophasor system architecture in response to the cyber-risk score includes removing a vulnerable component from the synchrophasor system architecture when a cyber-risk is detected.
17. The method of claim 11 , wherein the synchrophasor system architecture is adapted in real-time operation of the synchrophasor system in response to the cyber-risk score and a measurement of the synchrophasor system.
18. The method of claim 11 , wherein the individual cyber-risk scores vary based on a location determined for an attacker on the synchrophasor system architecture.
19. The method of claim 11 , wherein the individual cyber-risk scores vary based on a severity of consequences resulting from an attack on the respective elements in the synchrophasor system architecture.
20. The method of claim 11 , further comprising assigning a sub-branch of the event tree model a nonbinary value indicating a likelihood of a component in the synchrophasor system detecting an abnormality in the measurement data.
21. A computer-readable storage medium including instructions that upon execution cause a computer system to:
generate an event tree model of a timing-attack on a synchrophasor system architecture, at least one sub-branch of the event tree model comprising a nonbinary value indicating a likelihood of a component in the synchrophasor system architecture detecting an abnormality in the measurement data;
determine a cyber-risk score of the synchrophasor system architecture using the event tree model, wherein the cyber-risk score is based at least in part on resources needed by an attacker to exploit a respective vulnerability in the synchrophasor system architecture, the resources on which the cyber-score is at least partially based including cybersecurity privileges; and
identify a component of the synchrophasor system architecture as being vulnerable to a cyber attack.
22. The computer-readable storage medium of claim 21 , wherein generating the event tree model comprises generating a branch-point of the event tree model for a respective component of the synchrophasor system and sub-branches from the branch-point for different respective consequences of a timing attack at the respective component.
23. The computer-readable storage medium of claim 21 , wherein the cyber-risk score of the synchrophasor system architecture is a vector having elements corresponding to different components of the synchrophasor system architecture.
24. The computer-readable storage medium of claim 21 , wherein the synchrophasor system architecture produces data that includes data status bits for one or more measurements of elements in the synchrophasor system architecture, the data status bits including a dedicated error bit indicative of an error occurring during collection of the data.
25. The computer-readable storage medium of claim 21 , wherein the event tree model describing a chronological series of events subsequent to a triggering event.